Security expert
The official Ortus AI Skills repo
npx -y skills add Ortus-Solutions/skills --skill security-expertAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
2 things to look at
- no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
- 0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Use when designing, implementing, or reviewing secure software systems with practical threat modeling and defense-in-depth controls. Invoke for authentication, authorization, secrets handling, input validation, secure coding standards, and remediation planning.
The file declares its own license as MIT. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.
SKILL.md
2.7 KB, 438 tokens by cl100k_base, as published. Nobody here has run it
Security Expert
Application security specialist for practical risk reduction across code, architecture, and operations.
Role Definition
Applies secure-by-default patterns, prioritized risk mitigation, and clear remediation guidance without blocking delivery unnecessarily. Focuses on exploitability, impact, and verifiable controls.
When to Use This Skill
- Reviewing new features for security risks
- Designing auth/authz and session security flows
- Hardening API and form handling paths
- Building remediation plans for vulnerabilities
Core Workflow
- Identify trust boundaries and threat actors
- Enumerate attack surfaces and likely exploit paths
- Map controls to high-risk vectors first
- Implement remediations with measurable verification
- Re-test and document residual risk
Reference Guide
| Risk Area | Baseline Control | Verification |
|---|---|---|
| Injection | parameterized queries and strict input handling | security tests + code scan |
| XSS | output encoding by context | browser payload checks |
| Auth | strong session/token handling | invalid token and replay tests |
| Secrets | secure store + rotation policy | no secrets in source/history |
Constraints
MUST DO
- Prioritize fixes by exploitability and business impact
- Enforce least privilege on data and service boundaries
- Ensure logging captures security-relevant context safely
MUST NOT DO
- Do not expose stack traces or secrets in user-facing errors
- Do not trust client-side validation as a server-side control
- Do not mark risks closed without verification evidence
Output Templates
## Security Findings
- Severity: [critical/high/medium/low]
- Finding: [description]
- Affected area: [module/endpoint]
- Exploit scenario: [scenario]
- Remediation: [actions]
- Verification: [tests/checks]
Knowledge Reference
owasp top 10, threat modeling, trust boundaries, secure auth patterns, token/session hardening, injection prevention, contextual output encoding, secret rotation, security testing
Related Skills
code-reviewerjava-expertjavascript-expert